ISO 27001 Annex A 5.13 Labelling of information
What it says
An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and use clear labels to show how sensitive information is, so it is correctly handled.
This control is about putting labels on information to show how sensitive it is. This matters because the labels help people know how to handle the information properly. Without clear labels, sensitive information could be mishandled or exposed, leading to data breaches or privacy violations.
Free. Save your status, tasks and notes.
Why it matters
Without classification-based labels, staff and systems may apply the wrong handling and sharing rules, increasing the chance of inadvertent disclosure.
How to implement
The IT manager should develop procedures for labelling information based on its sensitivity.
They can do this by aligning with the organisation's classification scheme, making sure each piece of information has a label that corresponds to its confidentiality level.
The HR department should train employees on how to use and apply these labels.
They can conduct workshops to explain the different types of labels and what they mean so that staff members are aware of how to handle information safely.
The office manager should ensure that both physical and digital documents are labelled appropriately.
They can set up a system to use physical labels like rubber stamps for hard copies and metadata tags for electronic files.
The compliance officer must ensure that exceptions to labelling (like non-confidential information) are documented in the procedures.
They should also address special cases where labelling may not be possible and outline alternative safeguards.
The IT team should ensure that information systems automatically append the right metadata for digital files, making it easier to handle information according to its sensitivity.
This includes setting up system rules that apply the correct labels as information is created or modified.
Keep it running
Embed classification labels in documents/emails via templates and auto-tagging; ensure labels and handling instructions are updated immediately after reclassification.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the documented procedure on information labelling.
Look at
Check if the procedure aligns with the organisation's classification scheme and covers all formats of information.
Good evidence
The procedure is comprehensive, easy to understand, and covers physical and digital labelling with details on exceptions.
- Check 2 of 5What an auditor asks for
Ask for
Request training records for staff on information labelling.
Look at
Verify that all relevant personnel have received training on how to properly label sensitive information.
Good evidence
Training records show that all staff have participated, and the content covers the procedures thoroughly.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see examples of labelled documents, both physical and electronic.
Look at
Examine whether the labels are clear, consistent, and in line with the organisation's classification scheme.
Good evidence
Documents carry labels that are easy to identify and accurately reflect their sensitivity level.
- Check 4 of 5What an auditor asks for
Ask for
Request information system settings or policies on metadata tagging.
Look at
Ensure that metadata settings enforce the application of classification labels in digital formats.
Good evidence
Systems are configured to automatically add appropriate metadata, facilitating correct information management.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the records of any incidents related to mislabelled information.
Look at
Identify causes of mishandling and how they were addressed, if occurred.
Good evidence
Incidents are rare, and when they occur, they have been promptly addressed with adjustments in procedures or training.
Mappings
Closest match in ASD Information Security Manual: ISM-0201, Labelling requirements for TOP SECRET conduits, which this control covers in full and more.
ASD Information Security Manual: 20 mappings
This control is broader than ISM-0201.
ISM-0201 requires very specific physical labelling of TOP SECRET conduits (minimum label size, five-metre intervals, and the marking 'TS RUN'). Annex A 5.13 requires an organisation to establish and implement procedures for labelling information in line with its classification scheme, which can include requirements for how classified assets and supporting infrastructure are marked. ISM-0201 is a highly prescriptive, TOP SECRET-specific implementation detail within the broader labelling governance envisaged by Annex A 5.13.
This control is broader than ISM-0218.
ISM-0218 requires TOP SECRET fibre-optic fly leads over five metres to be run in a protective, easily inspected pathway and to be clearly labelled at the IT equipment end with the wall outlet box identifier. Annex A 5.13 requires the organisation to implement information labelling procedures aligned to its classification scheme, which can include labelling of associated assets and infrastructure (such as cabling/ports) used to handle classified information. ISM-0218 is a prescriptive, TS-specific application of labelling (plus physical routing/protection) while Annex A 5.13 is broader and does not mandate protective pathways or inspection characteristics.
This control is broader than ISM-0270.
Annex A 5.13 involves implementing procedures for information labelling aligned to the organisation's classification scheme. ISM-0270 applies this specifically to emails, requiring protective markings based on their sensitivity. ISM-0270 is an example of Annex A 5.13's broader information labelling procedures applied to emails.
This control is broader than ISM-0272.
ISM-0272 requires protective marking tools to prevent users selecting protective markings that the system is not authorised to process, store or communicate. This directly relates to Annex A 5.13 (Labelling of Information), which requires procedures for applying labels/markings in accordance with the organisation's classification scheme, including consistent application. ISM-0272 is a specific technical enforcement requirement within tooling, while Annex A 5.13 is broader and can be satisfied through a mix of policy, process, and technology across many labelling methods.
This control is broader than ISM-0294.
Annex A 5.13 requires the development and implementation of procedures for labelling information in accordance with the organisation's classification scheme. ISM-0294 specifically mandates the labelling of IT equipment with protective markings based on the sensitivity of the information handled by the equipment, which is a narrower application of the broader concept in Annex A 5.13.
This control is broader than ISM-0332.
Annex A 5.13 requires procedures for labelling information as per the classification scheme. ISM-0332 is an application of this principle for specific media, enforcing labels to reflect media sensitivity. This is a specific instance of the broader labelling required under Annex A 5.13.
This control is broader than ISM-0926.
ISM-0926 mandates a specific labelling/identification convention by prohibiting salmon pink and red for certain sensitivity/classification levels of cables. This aligns with Annex A 5.13, which requires procedures for information labelling in accordance with an organisation's classification scheme, and cable colour can be part of that labelling scheme for physical assets. Annex A 5.13 is broader (covers all information labelling methods and media), whereas ISM-0926 addresses only a narrow, cable-colour rule.
This control is broader than ISM-1089.
ISM-1089 requires email protective marking tools to prevent users from selecting a lower protective marking when replying to or forwarding an email. ISO/IEC 27001:2022 Annex A 5.13 requires procedures for information labelling aligned to the organisation's classification scheme, which includes ensuring labels/markings are applied correctly in communications. ISM-1089 is a specific technical enforcement mechanism for one labelling scenario (email reply/forward), whereas Annex A 5.13 is broader and covers labelling procedures across information types and channels.
This control is broader than ISM-1107.
ISM-1107 requires that Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are not coloured salmon pink or red to avoid misleading classification cues in facilities. Annex A 5.13 requires the organisation to implement procedures for information labelling in accordance with its classification scheme, which can include prescribed visual identifiers and rules preventing confusing or incorrect markings. ISM-1107 is a specific, prescriptive instance of a labelling/marking rule applied to a particular physical item, whereas Annex A 5.13 governs labelling procedures across information and associated assets more broadly.
This control is broader than ISM-1216.
ISM-1216 requires SECRET and TOP SECRET cables that do not use conformant colouring to be banded with the correct colour and labelled at inspection points. ISO/IEC 27001:2022 Annex A 5.13 requires an organisation to define and implement procedures for labelling in line with its classification scheme, which can include physical assets and media where applicable. ISM-1216 is a highly specific, physical implementation case of classification labelling, while Annex A 5.13 is broader and procedural across information types.
This control is broader than ISM-1720.
ISM-1720 requires wall outlet boxes for SECRET systems to be coloured salmon pink, giving a visible classification marking on network infrastructure. This is a specific application of the labelling procedures that Annex A 5.13 requires in line with the organisation's classification scheme, extending classification labelling to the physical assets through which classified information flows. Annex A 5.13 covers labelling of information and associated assets in all formats, whereas ISM-1720 prescribes a single colour convention for one classification level.
This control partially overlaps ISM-0271.
ISM-0271 requires that protective marking tools do not automatically insert protective markings into emails, controlling how labels are applied in an email context. Annex A 5.13 requires procedures for information labelling in accordance with the organisation's classification scheme, including rules for when and how labels are applied. They overlap because both address the application of labels/markings, but ISM-0271 is a specific constraint on automated labelling in email tools whereas Annex A 5.13 is broader and covers labelling procedures across information types and systems.
This control partially overlaps ISM-0293.
ISM-0293 requires IT equipment to be classified (and practically labelled) according to the highest data sensitivity it can process, store, or communicate. ISO/IEC 27001:2022 Annex A 5.13 requires procedures for labelling information in line with the organisation's classification scheme, which complements equipment labelling by ensuring the data itself is marked consistently. The overlap is in the use of classification to drive labelling outcomes, but ISM-0293 is asset/equipment-centric while Annex A 5.13 is information-centric.
This control partially overlaps ISM-0296.
ISM-0296 requires an organisation to seek ASD approval before applying any labels to the external surfaces of high assurance IT equipment, to avoid creating security risks through markings. This relates to Annex A 5.13, which requires organisations to establish and implement procedures for labelling information in line with their classification scheme, including how labels are applied and controlled. The overlap is in governance of labelling practices, but ISM-0296 is specifically about externally visible equipment labelling and an external approval step, whereas Annex A 5.13 is broader and primarily about labelling information (and associated media) rather than equipment surfaces.
This control partially overlaps ISM-0378.
Annex A 5.13 requires organisations to develop and implement procedures for information labelling aligned to an information classification scheme. ISM-0378 relates by addressing the lifecycle handling of those labels-requiring labels/markings that reveal owner or sensitivity to be removed from media before disposal. ISM-0378 is narrower and disposal-focused, whereas Annex A 5.13 is broader and covers how labels are defined and applied across information handling.
This control supports ISM-0337.
ISM-0337 mandates that media be used only with systems authorised for its classification. Annex A 5.13 is a prerequisite since consistent labelling assists in identifying media classifications, which is crucial for applying authorised-system restrictions per ISM-0337. Annex A 5.13 focuses on media marking, while ISM-0337 enforces authorised system use.
This control supports ISM-0831.
ISM-0831 requires media to be handled in accordance with its sensitivity or classification to protect information. Annex A 5.13 supports this by requiring information labelling procedures aligned to the classification scheme, which helps personnel recognise the classification of media and apply the correct handling. ISM-0831 is focused on the handling behaviour, whereas Annex A 5.13 is focused on making classification visible and actionable via labels.
This control supports ISM-1535.
ISM-1535 requires processes and supporting procedures to prevent AUSTEO, AGAO, and REL data from being exported to unsuitable foreign systems. Annex A 5.13 requires information labelling procedures that are aligned to the organisation's classification scheme. This is a prerequisite for reliably identifying which content must be protected from foreign export. Without consistent labelling or equivalent classification metadata, implementing effective rules and checks for ISM-1535, like DLP policies and transfer approvals, is significantly more error-prone and difficult to enforce.
This control supports ISM-2094.
ISM-2094 requires AI applications to detect and block sensitive data exposure and improper output via content filtering. ISO/IEC 27001:2022 Annex A 5.13 requires information labelling aligned to the organisation's classification scheme. Effective AI content filtering typically depends on consistent labels/classification (e.g. sensitivity tags or categories) to tune detection rules and reduce false positives/negatives, so Annex A 5.13 provides a prerequisite foundation even though it does not mandate filtering.
This control depends on ISM-0393.
ISM-0393 requires databases and their contents to be classified based on the sensitivity/classification of the data they contain. ISO/IEC 27001:2022 Annex A 5.13 focuses on labelling information in accordance with the classification scheme, which helps make database classification visible and actionable (e.g. database labels/metadata, schema tags, environment banners). Annex A 5.13 does not require determining the classification in the first place, so it supports rather than duplicates ISM-0393.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.